`cookieStore.HTTPOnly = false` is this required?

[egor-ryashin]

I wonder what's the intent here - there's no description, will it work with true values? https://github.com/volatiletech/authboss-sample/blob/8e0236a6de63c5cbebe539e06ece2efa990ab9af/blog.go#L235

The same question for other insecure settings like:

	cookieStore.Secure = false